The point of encoding is not security related; it's just to make sure the link and html is valid and well-formed. Certain chars cannot be used in queryStringschars cannot be used in queryStrings, including the chars typically needed to form malicious JS commands.
Browsers attempt to interpret some mal-formed (under-escaped; like
gets inlined with
%22 etc) urls, so that example might work w/o escaping, but more complex scripts would fall flat without the "percent encoding" we use for URI search params.